JP2022115518A - Information processing program, information processing method, and information processing device - Google Patents

Abstract

To generate a machine learning model that is resistant to white-box attacks on training data estimation.SOLUTION: A first machine learning model A trained with first training data is used to mechanically generate meaningless data as an initial value to create additional data. The first training data and the additional data are combined to create second training data. The second training data is used to train the machine learning model.SELECTED DRAWING: Figure 4

Description

The present invention relates to an information processing program, an information processing method, and an information processing apparatus.

In recent years, the development and use of systems using machine learning are progressing rapidly. On the other hand, various security problems specific to systems using machine learning have also been found. For example, a training data estimation attack is known in which training data used for machine learning is estimated and stolen.

As a training data estimation attack, for example, a machine learning model is extracted by analyzing a face recognition edge device used in a face recognition system, and a training data estimation attack is performed on this machine learning model to use it as training data. to estimate the face image.

A training data estimation attack is an attack that targets a trained model (machine learning model) that has completed a training phase, and is classified into a black box attack and a white box attack.
Black-box attacks infer training data from input and output data in the inference phase.

As a defense method against black-box attacks, for example, a method of simply reducing output information by adding noise to the output of a trained model, removing certainty, or the like is known. There is also a known method of disguising gradients and luring them to pre-prepared decoy datasets against attacks.

A white-box attack infers its training data from the trained machine learning model itself. As a defense method against white-box attacks, a method is known that generates a trained machine learning model that is resistant to training data estimation by adding appropriate noise to the parameters when updating the parameters of the machine learning model. there is DP-SGD (Differential Private-Stochastic Gradient Descent), for example, is a defense method against such white box attacks.

JP 2020-115312 A JP 2020-119044 A

In general, there is always a risk that an attacker can obtain the machine learning model itself, and defense against black box attacks alone is not sufficient.

On the other hand, in conventional defense methods against white-box attacks, adding noise to the parameters of the machine learning model reduces the estimation accuracy, so the strength of attack resistance is a trade-off with accuracy. Therefore, there is a problem that it cannot be introduced into a system that requires the accuracy of the machine learning model.
In one aspect, the present invention aims to enable the generation of machine learning models that are resistant to white-box attacks on training data estimation.

Therefore, the information processing program mechanically generates meaningless data as initial values using a first machine learning model that has been trained using the first training data to create additional data. Combining the data with the additional data to create second training data, and causing a computer to perform a process of training a machine learning model using the second training data.

According to one embodiment, a machine learning model can be generated that is resistant to white-box attacks on training data estimation.

It is a figure which illustrates the hardware constitutions of the information processing apparatus as an example of embodiment. 1 is a diagram illustrating a functional configuration of an information processing device as an example of an embodiment; FIG. FIG. 10 is a diagram for explaining processing of a mini-batch creation unit in the information processing apparatus as one example of the embodiment; FIG. 4 is a diagram showing an overview of a machine learning model training method in an information processing apparatus as an example of an embodiment; 6 is a flowchart for explaining a training method for a machine learning model in an information processing apparatus as one example of an embodiment; FIG. 10 is a diagram for explaining a result of a white-box attack on training data estimation for a machine learning model generated by an information processing apparatus as an example of an embodiment;

Embodiments of the information processing program, the information processing method, and the information processing apparatus will be described below with reference to the drawings. However, the embodiments shown below are merely examples, and there is no intention of excluding various modifications and application of techniques not explicitly described in the embodiments. In other words, the present embodiment can be modified in various ways without departing from the spirit of the embodiment. Also, each drawing does not mean that it has only the constituent elements shown in the drawing, but can include other functions and the like.

(A) Configuration FIG. 1 is a diagram illustrating a hardware configuration of an information processing apparatus 1 as an example of an embodiment.
The information processing apparatus 1, for example, as shown in FIG. have as These components 11 to 18 are configured to communicate with each other via a bus 19 .

A processor (control unit) 11 controls the entire information processing apparatus 1 . Processor 11 may be a multiprocessor. The processor 11 is, for example, any one of a CPU, MPU (Micro Processing Unit), DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), PLD (Programmable Logic Device), and FPGA (Field Programmable Gate Array). may Also, the processor 11 may be a combination of two or more types of elements among CPU, MPU, DSP, ASIC, PLD, and FPGA.

Then, the processor 11 executes a control program (information processing program: not shown) to cause the training processing unit 100 (the first training execution unit 101, the additional training data generation unit 102, and the second training execution unit 100) illustrated in FIG. 105) is realized.

In addition, the information processing device 1 performs the function as the training processing unit 100 by executing a program {information processing program or OS (Operating System) program} recorded on a computer-readable non-temporary recording medium, for example. come true.

A program describing the contents of processing to be executed by the information processing apparatus 1 can be recorded in various recording media. For example, a program to be executed by the information processing device 1 can be stored in the storage device 13 . The processor 11 loads at least part of the program in the storage device 13 into the memory 12 and executes the loaded program.

Also, the program to be executed by the information processing device 1 (processor 11) can be recorded in a non-temporary portable recording medium such as the optical disk 16a, the memory device 17a, the memory card 17c, or the like. A program stored in a portable recording medium becomes executable after being installed in the storage device 13 under the control of the processor 11, for example. Alternatively, the processor 11 can read and execute the program directly from the portable recording medium.

The memory 12 is a storage memory including ROM (Read Only Memory) and RAM (Random Access Memory). A RAM of the memory 12 is used as a main storage device of the information processing apparatus 1 . The RAM temporarily stores at least part of the OS program and the control program to be executed by the processor 11 . The memory 12 also stores various data necessary for processing by the processor 11 .

The storage device 13 is a storage device such as a hard disk drive (HDD), SSD (Solid State Drive), storage class memory (SCM), etc., and stores various data. The storage device 13 is used as an auxiliary storage device for the information processing apparatus 1 . The storage device 13 stores an OS program, a control program, and various data. The control program includes an information processing program.

A semiconductor storage device such as an SCM or a flash memory can also be used as the auxiliary storage device. Alternatively, a plurality of storage devices 13 may be used to configure RAID (Redundant Arrays of Inexpensive Disks).

Further, in the storage device 13, when a first training execution unit 101, an additional training data generation unit 102 (an additional data generation unit 103 and a mini-batch generation unit 104), and a second training execution unit 105, which will be described later, execute each process, Various generated data may be stored.

A monitor 14 a is connected to the graphics processing unit 14 . The graphics processing unit 14 displays an image on the screen of the monitor 14a according to instructions from the processor 11. FIG. Examples of the monitor 14a include a display device using a CRT (Cathode Ray Tube), a liquid crystal display device, and the like.

A keyboard 15 a and a mouse 15 b are connected to the input interface 15 . The input interface 15 transmits signals sent from the keyboard 15 a and the mouse 15 b to the processor 11 . Note that the mouse 15b is an example of a pointing device, and other pointing devices can also be used. Other pointing devices include touch panels, tablets, touch pads, trackballs, and the like.

The optical drive device 16 uses laser light or the like to read data recorded on the optical disc 16a. The optical disk 16a is a portable, non-temporary recording medium on which data is recorded so as to be readable by light reflection. The optical disk 16a includes DVD (Digital Versatile Disc), DVD-RAM, CD-ROM (Compact Disc Read Only Memory), CD-R (Recordable)/RW (ReWritable), and the like.

The device connection interface 17 is a communication interface for connecting peripheral devices to the information processing apparatus 1 . For example, the device connection interface 17 can be connected with a memory device 17a and a memory reader/writer 17b. The memory device 17a is a non-temporary recording medium equipped with a communication function with the device connection interface 17, such as a USB (Universal Serial Bus) memory. The memory reader/writer 17b writes data to the memory card 17c or reads data from the memory card 17c. The memory card 17c is a card-type non-temporary recording medium.

The network interface 18 is connected to a network (not shown). The network interface 18 may be connected to other information processing devices, communication devices, etc. via a network. For example, an input image or an input text may be input via a network.

FIG. 2 is a diagram illustrating the functional configuration of the information processing device 1 as an example of the embodiment. The information processing device 1 has a function as a training processing unit 100, as shown in FIG.
In the information processing device 1, the processor 11 executes a control program (information processing program) to realize a function as the training processing section 100. FIG.

The training processing unit 100 uses training data to implement learning processing (training processing) in machine learning. That is, the information processing device 1 functions as a training device for training a machine learning model by the training processing unit 100 .

The training processing unit 100 implements learning processing (training processing) in machine learning, for example, using training data (teacher data) to which correct labels are assigned. The training processing unit 100 trains a machine learning model using training data to generate a trained machine learning model that is resistant to training data estimation.

The machine learning model may be, for example, a deep learning model (deep neural network). The neural network may be a hardware circuit, or a virtual network of software that connects layers virtually constructed on a computer program by the processor 11 or the like.
The training processing unit 100 includes a first training execution unit 101, an additional data creation unit 103, and a second training execution unit 105, as shown in FIG.

The first training execution unit 101 trains a machine learning model using training data to generate a trained machine learning model.
The training data is configured, for example, as a combination of input data x and correct output data y.

Training of the machine learning model performed by the first training execution unit 101 using training data may be referred to as first training. Also, a machine learning model before training by the first training execution unit 101 is sometimes referred to as a first machine learning model. Since the first machine learning model is a machine learning model before training is performed, it can be said to be an empty machine learning model. Also, the machine learning model may simply be called a model.
Also, the training data used for the first training by the first training execution unit 101 may be referred to as first training data or training data A hereinafter.

Furthermore, the trained machine learning model generated by the first training execution unit 101 may be referred to as a second machine learning model or machine learning model A. Model parameters of the machine learning model A are set by the first training by the first training execution unit 101 .

The first training execution unit 101 can use a known technique to train the first machine learning model using the training data A to generate a second machine learning model (machine learning model A). A detailed description is omitted.

The additional training data creation unit 102 generates training data used when the second training execution unit 105, which will be described later, performs additional training on the second machine learning model (machine learning model A) generated by the first training execution unit 101. to create Hereinafter, the training data used when performing additional training on the second machine learning model may be referred to as second training data or training data B. Training data B may be referred to as additional training data.
The additional training data creation unit 102 includes an additional data creation unit 103 and a mini-batch creation unit 104 .

The additional data creating unit 103 creates a plurality of additional data. Additional data is data that is not input to machine learning model A in general machine learning model operation, and is artificial data that is classified into a specific label in a classifier.
The additional data creation unit 103 creates the additional data by, for example, the gradient descent method of acquiring the gradient of the machine learning model A and updating the input in the direction in which the certainty increases.

Below is an example of how to generate additional data using simple gradient descent (steps 1-4).
(Procedure 1) The additional data creation unit 103 first sets an objective function.
Input for machine learning model A: X
Output of machine learning model A: f(X) = (f ₁ (X), …, f _n (X))
Target label: t
, the objective function can be expressed, for example, by the following equation (1).

L(X) = (1-f _t (X)) ² (1)

When the value of L(X) above is minimized, X is classified into label t with a certainty of 1. Since it depends on label t in this way, it is necessary to process step 1 for all labels. be.

(Procedure 2) As an initial value, prepare input of meaningless data (for example, noise or a constant value) for the machine learning model A (hereinafter referred to as initial value X ₀ ).
The initial value X ₀ may be prepared and set in advance by an operator or the like, or may be generated by the additional data creation unit 103 .
(Procedure 3) The additional data creation unit 103 acquires the differential value L'(X ₀ ) of L(X) around X ₀ .
(Procedure 4) The additional data creation unit 103 sets X ₀ -λL'(X ₀ ) as additional data. λ is a hyperparameter.

Note that the method of creating the additional data is not limited to this, and can be changed as appropriate. For example, other objective functions may be used. Moreover, the above procedure 4 may be repeated a certain number of times. Furthermore, the formula in procedure 4 above may be changed.

The additional data generation unit 103 uses a machine learning model A (first machine learning model) trained with training data A (first training data) to mechanically generate meaningless data (X ₀ ) as an initial value. Generate to create additional data.
Further, the additional data may be generated using an optimization method other than the gradient descent method, such as an evolutionary algorithm, which may be modified in various ways.

If the input data is image data, for example, fooling image may be used as the additional data. It should be noted that the fooling image can be generated by a known method, and its explanation is omitted.

The mini-batch creation unit 104 adds the additional data created by the additional data creation unit 103 to the training data A to create second training data (training data B, additional training data).

The mini-batch creation unit 104 up-samples the training data A or down-samples the additional data so that the number of samples of the additional data is sufficiently smaller than the number of samples of the training data A.
For example, the mini-batch creation unit 104 adjusts the numbers of training data A and additional data so that the ratio of additional data to training data A is a predetermined value (α).

That is, when the additional data to the training data A is less than the predetermined ratio α, the mini-batch creation unit 104 performs at least one of downsampling of the training data A and upsampling of the additional data, thereby Let the ratio of additional data to data A be α. On the other hand, when the additional data to the training data A is equal to or greater than the predetermined ratio α, the mini-batch creation unit 104 performs at least one of upsampling of the training data A and downsampling of the additional data to Let the ratio of additional data to data A be α. Note that a technique such as noise addition may be used for upsampling.

By increasing the ratio of the additional data to the training data A, the machine learning model (machine learning model B) generated by the second training execution unit 105 using the second training data (training data B) , can improve resistance to white-box attacks. On the other hand, increasing the ratio of additional data to training data A may reduce the accuracy of the machine learning model (machine learning model B). Therefore, it is desirable to set the threshold value (α) representing the ratio of the additional data to the training data A to a value as large as possible within the range in which the accuracy of the machine learning model (machine learning model B) is maintained.
A mini-batch creation unit 104 creates a plurality of mini-batches using the training data A and the additional data.

FIG. 3 is a diagram for explaining processing of the mini-batch creation unit 104 in the information processing apparatus 1 as an example of the embodiment.
The mini-batch creation unit 104 shuffles each mini-batch so that a certain ratio of additional data is included in order to stabilize training (machine learning) by the second training execution unit 105, which will be described later.

That is, the mini-batch creation unit 104 randomly rearranges (shuffles) the training data A and the additional data separately, and equally divides them into N (N is a natural number of 2 or more). The 1/N training data A generated by dividing the training data into N equal parts is sometimes referred to as divided training data A hereinafter. Also, 1/N additional data generated by dividing the additional data into N equal parts may be referred to as divided additional data.

The mini-batch creation unit 104 creates one mini-batch by combining one divided training data A extracted from the N-divided (N-divided) training data A and the divided additional data extracted from the N-divided additional data. do. The mini-batch is used for training the machine learning model by the second training execution unit 105, which will be described later.

That is, the mini-batch creation unit 104 extracts a certain number from each of the shuffled data (training data A and additional data) and combines them into one mini-batch. A collection of these multiple mini-batches may be referred to as training data B.

The mini-batch creation unit 104 corresponds to a second training data creation unit that creates training data B (second training data) by combining training data A (first training data) and additional data. In addition, the mini-batch creation unit 104 updates at least one of the training data A and the additional data so that the ratio of the additional data to the training data A (first training data) in the training data B becomes a predetermined value (α). Perform sampling or downsampling.

Note that the mini-batch size can be appropriately set based on machine learning know-how. By shuffling the training data A and the additional data by the mini-batch creation unit 104, it is possible to suppress the occurrence of biased gradients in parameters set by training.

The second training execution unit 105 trains the machine learning model using the training data B created by the additional training data creation unit 102, thereby creating a machine learning model resistant to training data estimation attacks.

In the information processing apparatus 1 , the second training execution unit 105 performs training (additional training) using the training data B for the machine learning model A trained by the first training execution unit 101 .
Hereinafter, the machine learning model training performed by the second training executing unit 105 using the training data B may be referred to as second training.

Also, the trained machine learning model generated by the second training execution unit 105 may be referred to as a machine learning model B in some cases. Machine learning model B may be referred to as a third machine learning model.

The second training execution unit 105 trains the second machine learning model using the training data B using a known method, and the first training execution unit 101 trains the third machine learning model (machine learning model B). can be generated, and a detailed description thereof will be omitted.

The second training execution unit 105 performs further training on the trained machine learning model A using mini-batches generated by dividing the training data B created by the additional training data creation unit 102 into N. By performing (additional training), an additionally trained machine learning model B is generated. The model parameters of the machine learning model B are set by the second training (additional training) by the second training execution unit 105 .

The second training execution unit 105 trains the machine learning model using the training data B (second training data), and uses the training data B (second training data) to train the machine learning model A (first machine Perform retraining of the learning model).

The machine learning model B generated by the second training (additional training) by the second training execution unit 105 is resistant to white-box attacks that estimate the training data A.
By further training (additional training) to the trained machine learning model A, the time required for training the machine learning model can be shortened.

(B) Operation A machine learning model training method in the information processing apparatus 1 configured as described above as an example of the embodiment will be described with reference to FIG. 4 and according to the flowchart (steps S1 to S10) shown in FIG. . FIG. 4 is a diagram showing an outline of a machine learning model training method in the information processing apparatus 1. As shown in FIG.

In step S1, the operator prepares an empty machine learning model (first machine learning model) and training data A. Information constituting these empty machine learning models and training data A are stored in a predetermined storage area such as the storage device 13 .

In step S2, the first training execution unit 101 performs training (first training) of an empty machine learning model (first machine learning model) using the training data A to generate a trained machine learning model A ( (see symbol A1 in FIG. 4).
In step S3, the additional data generation unit 103 generates additional data by applying an optimization method to the machine learning model A (see symbol A2 in FIG. 4).

In step S4, the mini-batch creation unit 104 compares the number of additional data and the number of training data A, and checks whether the additional data to the training data A is less than a predetermined ratio α.

As a result of confirmation, if the additional data is less than the predetermined ratio α with respect to the training data A (see YES route of step S4), the process proceeds to step S6. In step S6, the mini-batch creation unit 104 performs at least one of downsampling of the training data A and upsampling of the additional data, thereby adjusting the ratio of the additional data to the training data A to α.

On the other hand, as a result of confirmation, if the additional data is equal to or greater than the predetermined ratio α with respect to the training data A (see NO route in step S4), the process proceeds to step S5. In step S5, the mini-batch creation unit 104 performs at least one of upsampling of the training data A and downsampling of the additional data, thereby adjusting the ratio of the additional data to the training data A to α.

Thereafter, in step S7, the mini-batch creation unit 104 randomly rearranges the training data A and the additional data separately. Furthermore, the mini-batch creation unit 104 divides the training data A and the additional data into N equal parts.

In step S8, the mini-batch creation unit 104 creates N-divided training data B by combining the N-divided (N-divided) training data A and the N-divided additional data (reference A3 in FIG. 4). reference).

In step S9, the second training execution unit 105 further trains the trained machine learning model A using each mini-batch of the N-divided training data B created by the additional training data creation unit 102. (additional training) to generate an additionally trained machine learning model B (see symbol A4 in FIG. 4).

In step S10, the second training execution unit 105 outputs the machine learning model B generated. Information forming the machine learning model B is stored in a predetermined storage area such as the storage device 13 .

(C) Effect As described above, according to the information processing device 1 as an example of the embodiment, the additional training data creation unit 102 creates the training data B including the additional data, and the second training execution unit 105 creates the training data B including the additional data. By performing further training (additional training) on the trained machine learning model A using the training data B, an additionally trained machine learning model B is generated.

The additional data is data that is not input in general machine learning model operation, and is mechanically generated data with meaningless data (X ₀ ) for the machine learning model A as an initial value. Therefore, even if a white-box attack of training data estimation is performed on additionally trained machine learning model B, estimation of training data A can be suppressed due to the influence of the additional data. If a training data estimation white-box attack is performed on the machine learning model B, the additional data can act as a decoy and block the training data A estimation.

FIG. 6 is a diagram for explaining the result of a white-box attack on training data estimation for a machine learning model generated by the information processing apparatus 1 as an example of the embodiment.

FIG. 6 shows an example in which a training data estimation attack is performed on a machine learning model that estimates (classifies) a number represented by an input number image based on the input number image. Also, in FIG. 6, the result of performing a training data estimation attack based on a machine learning model trained by a conventional method of adding noise to the parameters of the machine learning model, and the trained machine created by the information processing apparatus 1 and the results of a training data estimation attack based on the learning model.

In FIG. 6 , “model performance (Accuracy)” indicates the performance (accuracy) of the machine learning model trained by the conventional method and the machine learning model trained by the information processing apparatus 1 . It can be seen that the performance (0.9863) of the machine learning model trained by this information processing apparatus 1 is equivalent to the performance (0.9888) of the machine learning model trained by the conventional method.

"Training data estimation resistance (attack results)" includes images (digit images) generated by performing training data estimation attacks on each machine learning model, and numerical values as the original correct data of the digit images. are shown side by side.

In the training data estimation attack based on the machine learning model trained by the conventional method, the numerical image of the training data is reproduced by the white-box attack. On the other hand, in the results of the training data estimation attack based on the trained machine learning model by the information processing apparatus 1, the numerical images of the training data are not reproduced except for some, and the white box attack It can be seen that the recall of the digit images in the training data is low. That is, it indicates that the machine learning model trained by the information processing apparatus 1 is resistant to training data estimation attacks.

In addition, in conventional defense methods against white-box attacks that add noise to the parameters of machine learning models, the noise greatly affects the model's inference ability, resulting in a significant decrease in accuracy. On the other hand, in the machine learning model trained by the information processing apparatus 1, the additional data does not easily affect the inference ability of the normal input, so the decrease in accuracy can be relatively suppressed.

(D) Others The technology disclosed herein is not limited to the above-described embodiments, and various modifications can be made without departing from the spirit of the embodiments.
For example, each configuration and each process of the present embodiment can be selectively selected or combined as appropriate.

Further, in the above-described embodiment, the second training execution unit 105 performs further training (additional training) on the machine learning model A that has already been trained by the first training execution unit 101. It is not limited. The second training execution unit 105 may train an empty machine learning model using the second training data.
In addition, it is possible for a person skilled in the art to implement and manufacture the present embodiment based on the above disclosure.

(E) Supplementary Note Regarding the above embodiment, the following Supplementary Note will be disclosed.
(Appendix 1)
Using a first machine learning model trained with the first training data, mechanically generating meaningless data as initial values to create additional data,
Combining the first training data and the additional data to create second training data;
An information processing program, characterized by causing a computer to execute a process of training a machine learning model using the second training data.

(Appendix 2)
The information processing program according to supplementary note 1, wherein the training of the machine learning model using the second training data is retraining of the first machine learning model using the second training data.

(Appendix 3)
3. The information processing program according to appendix 1 or 2, causing the computer to execute a process of generating the additional data using an optimization technique.

(Appendix 4)
causing the computer to perform upsampling or downsampling of at least one of the first training data and the additional data so that the ratio of the additional data to the first training data is a predetermined value. The information processing program according to any one of Appendices 1 to 3, wherein:

(Appendix 5)
Using a first machine learning model trained with the first training data, mechanically generating meaningless data as initial values to create additional data,
Combining the first training data and the additional data to create second training data;
An information processing method, wherein a computer executes a process of training a machine learning model using the second training data.

(Appendix 6)
6. The information processing method according to claim 5, wherein the training of the machine learning model using the second training data is retraining of the first machine learning model using the second training data.

(Appendix 7)
7. The information processing method according to appendix 5 or 6, wherein the computer executes a process of generating the additional data using an optimization technique.

(Appendix 8)
The computer executes a process of upsampling or downsampling at least one of the first training data and the additional data such that the ratio of the additional data to the first training data is a predetermined value. The information processing method according to any one of Appendices 5 to 7.

(Appendix 9)
an additional data creation unit that creates additional data by mechanically creating meaningless data as initial values using the first machine learning model trained with the first training data;
a second training data creation unit that creates second training data by combining the first training data and the additional data;
and a second training execution unit that trains a machine learning model using the second training data.

(Appendix 10)
10. The information processing apparatus according to claim 9, wherein the second training execution unit re-trains the training first machine learning model using the second training data.

(Appendix 11)
11. The information processing apparatus according to appendix 9 or 10, wherein the additional data creation unit creates the additional data using an optimization method.

(Appendix 12)
The second training data creation unit performs upsampling or downsampling of at least one of the first training data and the additional data such that a ratio of the additional data to the first training data is a predetermined value. The information processing apparatus according to any one of Appendices 9 to 11, characterized by:

1 Information Processing Device 11 Processor 12 Memory 13 Storage Device 14 Graphic Processing Device 14a Monitor 15 Input Interface 15a Keyboard 15b Mouse 16 Optical Drive Device 16a Optical Disk 17 Equipment Connection Interface 17a Memory Device 17b Memory Reader/Writer 17c Memory Card 18 Network Interface 18a Network 19 bus 100 training processing unit 101 first training execution unit 102 additional training data creation unit 103 additional data creation unit 104 mini-batch creation unit 105 second training execution unit

Claims (6)

Using the first machine learning model trained with the first training data, mechanically generating meaningless data as initial values to create additional data,
Combining the first training data and the additional data to create second training data;
An information processing program for causing a computer to execute a process of training a machine learning model using the second training data. 2. The information processing program according to claim 1, wherein the training of said machine learning model using said second training data is retraining of said first machine learning model using said second training data. 3. The information processing program according to claim 1, causing said computer to execute a process of generating said additional data using an optimization method. causing the computer to perform upsampling or downsampling of at least one of the first training data and the additional data so that the ratio of the additional data to the first training data is a predetermined value. The information processing program according to any one of claims 1 to 3, wherein: Using the first machine learning model trained with the first training data, mechanically generating meaningless data as initial values to create additional data,
Combining the first training data and the additional data to create second training data;
An information processing method, wherein a computer executes a process of training a machine learning model using the second training data. an additional data creation unit that creates additional data by mechanically creating meaningless data as initial values using the first machine learning model trained with the first training data;
a second training data creation unit that creates second training data by combining the first training data and the additional data;
and a second training execution unit that trains a machine learning model using the second training data.

Images